Splunk Search

Display Date on Dashboard panel

chintan_shah
Path Finder

I want to show the previous week date on Title of panel.
Can anyone have some thoughts for it?

Tags (2)
0 Karma
1 Solution

niketn
Legend

You can run a search to calculate previous week date one of the ways would be through makeresults and using relative_time command.
Then you display the same using HTML panel with formatting of your choice.

  <search>
    <query>| makeresults
| eval prevWeekDate=strftime(relative_time(now(),"-7d"),"%Y/%m/%d")
| table prevWeekDate</query>
    <sampleRatio>1</sampleRatio>
    <preview>
      <set token="tok_Prev_Week_Date">$result.prevWeekDate$</set>
    </preview>
  </search>
  <row>
    <panel>
      <html>
        <div>
          <p style="color:blue;text-align:right;font-size:150%">$tok_Prev_Week_Date$
          </p>
        </div>
      </html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

You can run a search to calculate previous week date one of the ways would be through makeresults and using relative_time command.
Then you display the same using HTML panel with formatting of your choice.

  <search>
    <query>| makeresults
| eval prevWeekDate=strftime(relative_time(now(),"-7d"),"%Y/%m/%d")
| table prevWeekDate</query>
    <sampleRatio>1</sampleRatio>
    <preview>
      <set token="tok_Prev_Week_Date">$result.prevWeekDate$</set>
    </preview>
  </search>
  <row>
    <panel>
      <html>
        <div>
          <p style="color:blue;text-align:right;font-size:150%">$tok_Prev_Week_Date$
          </p>
        </div>
      </html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

chintan_shah
Path Finder

Thanks Niketnilay..so we cannot have dynamic title, but need to include html tags.

0 Karma

niketn
Legend

@chintan_shah... You can print this in Title also. I just used html as an example.

<panel>
   <title>Data from - $tok_Prev_Week_Date$ </title>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...